From 11f71f8506ca4e334f4e648940eabb0c6ebe9f5b Mon Sep 17 00:00:00 2001 From: Brian Zalewski Date: Wed, 12 Apr 2023 02:33:53 +0000 Subject: [PATCH] Update 2 files - /home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl - /home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.sh.tmpl --- ... => run_before_01-decrypt-age-key.sh.tmpl} | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) rename home/.chezmoiscripts/universal/{run_before_01-decrypt-age-key.tmpl => run_before_01-decrypt-age-key.sh.tmpl} (50%) diff --git a/home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl b/home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.sh.tmpl similarity index 50% rename from home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl rename to home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.sh.tmpl index 7f5cead6..7039b5ac 100644 --- a/home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl +++ b/home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.sh.tmpl @@ -1,4 +1,29 @@ #!/usr/bin/env bash +# @file Chezmoi-Age Secret Decryption +# @brief Ensures `age` is installed and then decrypts the `home/key.txt.age` file so that Chezmoi can utilize encrypted files +# @description +# This script begins by ensuring `age` is installed, the defualt program Chezmoi utilizes for handling encryption. +# The script then allows you to generate the decrypted `~/.config/age/chezmoi.txt` file by prompting you for the password +# to `home/key.txt.age` which is the encrypted encryption key file for using Chezmoi to add encrypted files to your Install +# Doctor fork. If no password is passed to the decryption password prompt, then all of the `encrypted_` files in the fork +# are deleted so that Chezmoi does not try to decrypt files without a decryption key file. +# +# ## Headless Installs +# +# If you do not want the script to prompt you for a password, then you can pass in an environment variable with +# `HEADLESS_INSTALL=true`. This variable ensures that nothing requiring input from the user blocks the provisioning process. +# If you want to automate a headless install that requires access to `encrypted_` files and encrypted variables, then +# you can save the decrypted Age key to `~/.config/age/chezmoi.txt` prior to running `bash <(curl -sSL https://install.doctor/start)`. +# +# ## GPG +# +# It is also possible to configure Chezmoi to utilize GPG instead of Age. This might be beneficial if you want to +# use a smart card / YubiKey for hardware-backed encryption. Otherwise, Age is a great encryption tool. +# +# ## Notes +# +# _It is possible that hardware-based smart-card-like GPG encryption might not work properly with Chezmoi yet. +# Learned this by attempting to use a YubiKey GPG setup using [this guide](https://github.com/drduh/YubiKey-Guide) and trying to get it to work with Chezmoi._ {{ includeTemplate "universal/logg-before" }} {{ includeTemplate "universal/profile-before" }}